Subject: [Idr] Note on "timing bomb"

From: Robert Raszuk <[email-masked]>
Date: Sun, 1 Nov 2015 21:17:43 -0800

As a comment on the "timing bomb" or comment to never apply timing it to
safi 1 let's observe that many routers have build in support for enabling
any command at time X and disable on time Y already today for a long time.

So the right way to look at this problem here is to ask ourselves if bgp is
the right protocol to carry it around or not.

As far as DDOS one thing that we keep forgetting is that device which
detected the malicious flow and advertised flow spec routes has no longer
any way of telling if the attack is over or not as filtering may happen far
away what was the original 5575 idea. Sure it can send withdraw after M
minutes as opposed to encode it in the update. So really the timing idea
for DDOS itself seems not that attractive.

But for automation in general which many currently discussed extensions are
about think interface set ACLs I think it does carry some value.

Best,
R.

---

From: Christopher Morrow <[email-masked]>
Date: Mon, 2 Nov 2015 16:49:11 +1100

>
> So the right way to look at this problem here is to ask ourselves if bgp
is the right protocol to carry it around or not.
>
> But for automation in general which many currently discussed extensions
are about think interface set ACLs I think it does carry some value.

You mean the enterprise use case a i mentioned at the mic?  Not sure how
much enterprise user there is for flowspec though.

> Best,
> R.
>
>
> _______________________________________________
> Idr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/idr
>

---

From: Christopher Morrow <[email-masked]>
Date: Mon, 2 Nov 2015 16:52:14 +1100

On Nov 2, 2015 2:49 PM, "Christopher Morrow" <[email-masked]>
wrote:
> > As a comment on the "timing bomb" or comment to never apply timing it
to safi 1 let's observe that many routers have build in support for
enabling any command at time X and disable on time Y already today for a
long time.
> >
> > So the right way to look at this problem here is to ask ourselves if
bgp is the right protocol to carry it around or not.

Sorry, I also forgot to say previously: "it's not clear that BGP is better
than Yang/netconf for the config distribution, really"

BGP distribution doesn't guarantee timeliness where execution of some
change via Netconf sound be more reliably timed, I would think.

---

From: Jeff Haas <[email-masked]>
Date: Mon, 2 Nov 2015 14:53:00 +0900

> On Nov 2, 2015, at 2:49 PM, Christopher Morrow <[email-masked]> wrote:
> 
> You mean the enterprise use case a i mentioned at the mic?  Not sure how much enterprise user there is for flowspec though.
> 
> 

Enough to support flowspec in IGP?

-- Jeff

---

From: Robert Raszuk <[email-masked]>
Date: Sun, 1 Nov 2015 21:53:36 -0800

Yes exactly Chris.

As far as enterprise vs flowspec I think as flowspec  is being now derailed
from DDOS protection tool to configuration and ACL push protocol it may be
in fact very useful beyond  SP/ISP geeks :)

Thanks,
R.
On Nov 2, 2015 6:49 AM, "Christopher Morrow" <[email-masked]>

---

From: Robert Raszuk <[email-masked]>
Date: Sun, 1 Nov 2015 21:57:44 -0800

I think it is not.

But here you have typical dilemma ... customers  asking vendors for doing
it in BGP ... and what you think  would vendors do ?

Cheers,
R.
On Nov 2, 2015 6:52 AM, "Christopher Morrow" <[email-masked]>
wrote:

> > > But for automation in general which many currently discussed
> extensions are about think interface set ACLs I think it does carry some
> value.
> > >
> >